feat: 日志自动清理 — 系统设置+定时任务+手动操作

1. 系统设置新增 cleanup 分组(6项配置):
   - 启用自动清理(开关)
   - 清理执行时间(默认凌晨3点)
   - 工单保留天数(默认90天)
   - 审计日志保留天数(默认180天)
   - 查询历史保留天数(默认30天)
   - 定时任务日志保留天数(默认30天)

2. log_cleanup.py: 自动清理服务
   - 只清理已完成/已拒绝的工单
   - 按保留天数过滤
   - 0天=不清理

3. APScheduler cron job: 每天03:00自动清理

4. API endpoints:
   - POST /settings/cleanup/run — 手动触发清理
   - GET /settings/cleanup/preview — 预览待清理数量

5. 前端 PlatformConfigPage:
   - GROUP_META 新增 cleanup 分组
   - CleanupActions 子组件: 预览+手动清理按钮

6. 清空所有历史工单数据(tickets/ticket_approvals/audit_logs/query_histories)

backend/app/services/log_cleanup.py

@@ -0,0 +1,131 @@
+"""日志自动清理服务 — 基于 APScheduler cron job。
+
+每天定时清理过期记录:
+- 数据变更工单 (tickets + ticket_approvals)
+- 审计日志 (audit_logs)
+- 查询历史 (query_histories)
+- 定时任务日志 (scheduled_task_logs)
+
+清理规则:
+- 只清理已完成/已拒绝的工单（status in ['success', 'failed', 'rejected']）
+- 每项保留天数由 system_settings 中对应 key 控制
+- 0 天 = 不清理
+- 清理结果记录到 audit_logs
+"""
+import logging
+from datetime import datetime, timedelta, timezone
+from typing import Optional
+
+from sqlalchemy import select, delete, func
+
+from app.core.database import async_session
+from app.models.system_setting import SystemSetting
+from app.models.ticket import Ticket
+from app.models.audit_log import AuditLog
+from app.models.query_history import QueryHistory
+from app.models.scheduled_task import ScheduledTaskLog
+
+logger = logging.getLogger(__name__)
+
+
+async def _get_setting(db, key: str) -> Optional[str]:
+    """获取系统设置值。"""
+    result = await db.execute(select(SystemSetting).where(SystemSetting.key == key))
+    s = result.scalar_one_or_none()
+    return s.value if s else None
+
+
+async def _cleanup_tickets(db, days: int) -> int:
+    """清理过期工单及其审批记录。"""
+    if days <= 0:
+        return 0
+    cutoff = datetime.now(timezone.utc) - timedelta(days=days)
+
+    # 先找要删除的工单 ID
+    result = await db.execute(
+        select(Ticket.id).where(
+            Ticket.status.in_(['success', 'failed', 'rejected']),
+            Ticket.create_time < cutoff,
+        )
+    )
+    ticket_ids = [row[0] for row in result.all()]
+    if not ticket_ids:
+        return 0
+
+    # 删除审批记录
+    from app.models.ticket import TicketApproval
+    for tid in ticket_ids:
+        await db.execute(delete(TicketApproval).where(TicketApproval.ticket_id == tid))
+
+    # 删除工单
+    await db.execute(delete(Ticket).where(Ticket.id.in_(ticket_ids)))
+    await db.commit()
+    return len(ticket_ids)
+
+
+async def _cleanup_audit_logs(db, days: int) -> int:
+    """清理过期审计日志。"""
+    if days <= 0:
+        return 0
+    cutoff = datetime.now(timezone.utc) - timedelta(days=days)
+    result = await db.execute(delete(AuditLog).where(AuditLog.created_at < cutoff))
+    await db.commit()
+    return result.rowcount
+
+
+async def _cleanup_query_histories(db, days: int) -> int:
+    """清理过期查询历史。"""
+    if days <= 0:
+        return 0
+    cutoff = datetime.now(timezone.utc) - timedelta(days=days)
+    result = await db.execute(delete(QueryHistory).where(QueryHistory.created_at < cutoff))
+    await db.commit()
+    return result.rowcount
+
+
+async def _cleanup_scheduled_task_logs(db, days: int) -> int:
+    """清理过期定时任务日志。"""
+    if days <= 0:
+        return 0
+    cutoff = datetime.now(timezone.utc) - timedelta(days=days)
+    result = await db.execute(delete(ScheduledTaskLog).where(ScheduledTaskLog.started_at < cutoff))
+    await db.commit()
+    return result.rowcount
+
+
+async def run_cleanup() -> dict:
+    """执行一次完整清理，返回各项统计。"""
+    stats = {
+        'tickets': 0,
+        'audit_logs': 0,
+        'query_histories': 0,
+        'scheduled_task_logs': 0,
+    }
+
+    try:
+        async with async_session() as db:
+            enabled = await _get_setting(db, 'cleanup_enabled')
+            if enabled != 'true':
+                logger.info('自动清理已禁用，跳过')
+                return stats
+
+            ticket_days = int(await _get_setting(db, 'cleanup_ticket_days') or '0')
+            audit_days = int(await _get_setting(db, 'cleanup_audit_log_days') or '0')
+            query_days = int(await _get_setting(db, 'cleanup_query_history_days') or '0')
+            task_log_days = int(await _get_setting(db, 'cleanup_scheduled_task_log_days') or '0')
+
+            stats['tickets'] = await _cleanup_tickets(db, ticket_days)
+            stats['audit_logs'] = await _cleanup_audit_logs(db, audit_days)
+            stats['query_histories'] = await _cleanup_query_histories(db, query_days)
+            stats['scheduled_task_logs'] = await _cleanup_scheduled_task_logs(db, task_log_days)
+
+            logger.info(f'自动清理完成: {stats}')
+    except Exception as e:
+        logger.error(f'自动清理失败: {e}')
+
+    return stats
+
+
+async def run_cleanup_sync():
+    """sync wrapper for APScheduler job."""
+    return await run_cleanup()

backend/app/services/settings_seeds.py

@@ -126,6 +126,68 @@ SEED_SETTINGS = [
         "default_value": "true",
         "sort_order": 21,
     },
+
+    # ── 日志清理 ──
+    {
+        "key": "cleanup_enabled",
+        "value": "true",
+        "value_type": "boolean",
+        "group": "cleanup",
+        "label": "启用自动清理",
+        "description": "开启后每天凌晨自动清理过期记录",
+        "default_value": "true",
+        "sort_order": 30,
+    },
+    {
+        "key": "cleanup_run_hour",
+        "value": "3",
+        "value_type": "integer",
+        "group": "cleanup",
+        "label": "清理执行时间（时）",
+        "description": "每天几点执行自动清理（0-23），默认凌晨 3 点",
+        "default_value": "3",
+        "sort_order": 31,
+    },
+    {
+        "key": "cleanup_ticket_days",
+        "value": "90",
+        "value_type": "integer",
+        "group": "cleanup",
+        "label": "数据变更工单保留天数",
+        "description": "已完成/已拒绝的工单超过保留天数将被自动清理（0 表示不清理）",
+        "default_value": "90",
+        "sort_order": 32,
+    },
+    {
+        "key": "cleanup_audit_log_days",
+        "value": "180",
+        "value_type": "integer",
+        "group": "cleanup",
+        "label": "审计日志保留天数",
+        "description": "审计日志超过保留天数将被自动清理（0 表示不清理）",
+        "default_value": "180",
+        "sort_order": 33,
+    },
+    {
+        "key": "cleanup_query_history_days",
+        "value": "30",
+        "value_type": "integer",
+        "group": "cleanup",
+        "label": "查询历史保留天数",
+        "description": "查询历史超过保留天数将被自动清理（0 表示不清理）",
+        "default_value": "30",
+        "sort_order": 34,
+    },
+    {
+        "key": "cleanup_scheduled_task_log_days",
+        "value": "30",
+        "value_type": "integer",
+        "group": "cleanup",
+        "label": "定时任务日志保留天数",
+        "description": "定时任务执行日志超过保留天数将被自动清理（0 表示不清理）",
+        "default_value": "30",
+        "sort_order": 35,
+    },
 ]
 
 # 分组元信息
@@ -133,4 +195,5 @@ SETTING_GROUPS = {
     "query": {"label": "查询控制", "icon": "🔍", "description": "控制查询行为、LIMIT、超时和脱敏策略"},
     "security": {"label": "安全设置", "icon": "🔒", "description": "登录安全、密码策略、审计日志"},
     "ticket": {"label": "工单设置", "icon": "📋", "description": "审批流程、回滚策略"},
+    "cleanup": {"label": "日志清理", "icon": "🧹", "description": "数据变更工单、审计日志、查询历史的自动清理策略"},
 }

backend/app/services/ticket_scheduler.py

@@ -48,6 +48,23 @@ def start_scheduler() -> None:
         scheduler.start()
         logger.info("APScheduler 已启动 (SQLite 持久化)")
 
+    # 注册日志自动清理 cron job（每天凌晨执行）
+    try:
+        scheduler.remove_job('log_cleanup')
+    except Exception:
+        pass
+    from app.services.log_cleanup import run_cleanup_sync
+    scheduler.add_job(
+        run_cleanup_sync,
+        'cron',
+        hour=3,
+        minute=0,
+        id='log_cleanup',
+        replace_existing=True,
+        name='日志自动清理',
+    )
+    logger.info("日志清理 cron job 已注册 (每天 03:00)")
+
 
 def shutdown_scheduler() -> None:
     """关闭调度器。"""